Does Splunk have permissions or any problems writing to the coldPath? Also, are there any indications in splunkd.log of any problems (or successes) rolling the warm buckets?
... View more
This would be help!!
http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/RemovedatafromSplunk
Just ready carefully... and always backup your files!!
Regards
Cris
... View more